The most important outcome of an information security program is improved organizational awareness of security responsibilities. This is because an effective information security program requires an organization to be aware of the risks it is facing and its responsibilities to protect itself from these risks. Understanding the security responsibilities and the associated risks, and having a plan in place to mitigate them, is essential in order to ensure the security of an organization's data and systems